Title: Java: CWE-016 Query to detect insecure configuration of Spring Boot Actuator by luchua-bc · Pull Request #5384 · github/codeql · GitHub
Open Graph Title: Java: CWE-016 Query to detect insecure configuration of Spring Boot Actuator by luchua-bc · Pull Request #5384 · github/codeql
X Title: Java: CWE-016 Query to detect insecure configuration of Spring Boot Actuator by luchua-bc · Pull Request #5384 · github/codeql
Description: Spring Boot is a popular framework that facilitates the development of stand-alone applications and micro services. Spring Boot Actuator helps to expose production-ready support features against Spring Boot applications. Endpoints of Spring Boot Actuator allow to monitor and interact with a Spring Boot application. Exposing unprotected actuator endpoints through configuration files can lead to information disclosure or even remote code execution vulnerability. Rather than programmatically permitting endpoint requests or enforcing access control, frequently developers simply leave management endpoints publicly accessible in the application configuration file application.properties without enforcing any access control through Spring Security. This is a very common issue and is also one of the highest rewarded vulnerabilities on the HackerOne platform. The query detects this issue in Spring Boot projects with Maven and application.properties, which is the most widely adopted deployment scenario. Please consider to merge the PR. Thanks.
Open Graph Description: Spring Boot is a popular framework that facilitates the development of stand-alone applications and micro services. Spring Boot Actuator helps to expose production-ready support features against Sp...
X Description: Spring Boot is a popular framework that facilitates the development of stand-alone applications and micro services. Spring Boot Actuator helps to expose production-ready support features against Sp...
Opengraph URL: https://github.com/github/codeql/pull/5384
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:f3645708-afb6-510c-9ee0-4ca7d7f948cc |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | E748:227D33:135FD95:1AF6D6F:6A4CACDC |
| html-safe-nonce | 710d1fb22ed6ee58b6a0df569259f880a22d0ba51be80226f4f46c4e8da28631 |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiJFNzQ4OjIyN0QzMzoxMzVGRDk1OjFBRjZENkY6NkE0Q0FDREMiLCJ2aXNpdG9yX2lkIjoiNjEzNjA2NTkzMTg1MDA2NzE2NCIsInJlZ2lvbl9lZGdlIjoiaWFkIiwicmVnaW9uX3JlbmRlciI6ImlhZCJ9 |
| visitor-hmac | a6d020c7e5e9ac8d3f0ee6a297b596eec52793a590885f7f07858d72d282a555 |
| hovercard-subject-tag | pull_request:590882846 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/github/codeql/pull/5384/files |
| twitter:image | https://avatars.githubusercontent.com/u/37377780?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/37377780?s=400&v=4 |
| og:image:alt | Spring Boot is a popular framework that facilitates the development of stand-alone applications and micro services. Spring Boot Actuator helps to expose production-ready support features against Sp... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | 3d11bb817438277de2a940854450e83a7d32b6aeb5014e9e6b00a6423900251c |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/github/codeql git https://github.com/github/codeql.git |
| octolytics-dimension-user_id | 9919 |
| octolytics-dimension-user_login | github |
| octolytics-dimension-repository_id | 143040428 |
| octolytics-dimension-repository_nwo | github/codeql |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 143040428 |
| octolytics-dimension-repository_network_root_nwo | github/codeql |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | ae90d426644ca15e89bacceb72e51f4e9dbf85f7 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width